Sitecore Managed Cloud Standard — Setup WAF Service Request

Sitecore Managed Cloud customers wanting to protect their Sitecore XP application from common web vulnerabilities and attacks can create a Setup Web Application Firewall (WAF) Service Request. This article outlines what Managed Cloud customers need to know about the technical implementation of the WAF.

For more details on the Azure Application Gateway and WAF products and how they work to secure a Sitecore Content Delivery server, see these details.

Once the Service Request is made to the Managed Cloud team, the following items must be provided. These can be included in the Service Request form or the engineer completing the setup will request them from the customer:

The PFX certificate that corresponds to the Sitecore CD web app public DNS name.

The following notes outline timing and the overall process followed by the Sitecore Managed Cloud team in completing this Service Request:

The WAF deployment takes about an hour. During this time, IP restrictions will be configured on the Sitecore Content Delivery web app in Azure, so the CD will become unavailable using the direct endpoint such as the *.azurewebsites.net URL. Access becomes available only via Public IP address.

We may turn off the IP restrictions after the deployment so the CD web app can be available as before. Customers that require this must request it in the Service Request.

Right after the WAF service is deployed, the customer must configure their DNS server to create the needed records. DNS records on NS-servers may take up to 72 hours to fully update, so the final configuration might require up to 3 days.

The Managed Cloud team will coordinate a time window with the customer for the WAF deployment. Best practice is to set up the WAF well before an environment goes live to reduce the risk of downtime or the impact of any unforeseen complications. The Managed Cloud team requests 48 hours notice to schedule the maintenance window.

For sites that are already “live,” the Managed Cloud team can NOT apply the usual IP restrictions on the Sitecore CD web app so the site remains available 100% through this process. At a later time, after WAF testing and customer DNS updates are completed to the customer's satisfaction, the IP restrictions can be enabled to block direct access to the Sitecore CD web app.